CVE-2026-14558
Deferred Deferred - Pending Action

PHP Object Injection in User Frontend WordPress Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: WPScan

Description
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-14558
EUVD
EUVD-2026-67567

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp_frontend frontend to 4.3.10 (exc)
wp_user_frontend wp_user_frontend to 4.3.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a PHP Object Injection flaw in the WP User Frontend WordPress plugin before version 4.3.10. It occurs because the plugin does not properly validate field type definitions and deserializes user-controlled post metadata when rendering posts. This allows users with Editor-level access or higher to inject arbitrary PHP objects, which could lead to remote code execution if a suitable POP chain exists on the site.

Detection Guidance

Check the installed version of the WP User Frontend plugin. If it is below 4.3.10, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If exploited, this vulnerability could allow attackers with Editor-level access or higher to execute arbitrary code on your WordPress site. This could lead to full site compromise, data theft, or further attacks against site visitors. The impact depends on the site's configuration and the presence of a suitable POP chain.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health data security). A successful exploit could result in unauthorized data exposure, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the WP User Frontend plugin to version 4.3.10 or later immediately. If updating is not possible, restrict Editor-level and higher user access to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14558. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart